Fix/stax fullstack setup

[anantbhargava-lgtm]

Summary

This PR resolves multiple blockers identified when building, running, and deploying Stax across the Frontend (Next.js), Backend (Spring Boot), and Terraform infrastructure. All components have been verified locally and validated for deployment.

---

Key Changes

1. Backend (server/)

• Prevent Crash on Fresh Databases: Fixed an unhandled IndexOutOfBoundsException in ProjectServiceImpl.enrichProjectsWithFields() when querying projects on an empty database (if (projects == null || projects.isEmpty()) return List.of();).

2. Frontend (frontend/)

• Resolve Infinite Loader / CSP Hydration Blocking: Removed the strict-dynamic nonce-based Content Security Policy header in middleware.ts. Statically prerendered HTML pages lacked the generated nonces on script tags, causing modern browsers to block all React client bundle execution and locking the page in an unhydrated shell. Strict CSP is now optionally toggled via ENABLE_STRICT_CSP=true.
• Add Cache-Control Headers: Added no-cache, no-store, must-revalidate response headers in middleware to prevent browsers from caching broken static shells.
• Local API Proxy Rewrites: Added Next.js rewrites in next.config.js for /api/* and /streaming/* targeting NEXT_PUBLIC_API_BASE_URL (default http://localhost:8080), eliminating CORS issues in local development.
• Authentication Bypass Toggle: Wired MainConfig.isAuthEnabled to NEXT_PUBLIC_AUTH_ENABLED so developers can run and test Stax without mandatory Google OAuth configuration.
• Added .env.template: Added the missing template file in frontend/ with standard local development defaults.
• Table Loading State: Added onError callback in ProjectsTable.tsx to ensure loading spinners clear if an API request fails.
• Git Hook Script Path: Fixed package.json to point to ../.git/hooks from within the frontend/ subdirectory.

3. Terraform Infrastructure (terraform/quickstart/)

• Added variables.tf: Parameterized project_id, region, admin_email, artifact_registry_repo, and gcs_bucket_name with sensible defaults.
• Removed Hardcoded IDs: Replaced hardcoded test project ID in main.tf and hardcoded bucket name in cloud_run_backend.tf with variables.
• Fixed IAM Roles & Safe Member Bindings:
  • Replaced invalid GCP role roles/admin with roles/resourcemanager.projectIamAdmin.
  • Migrated from authoritative google_project_iam_binding to additive google_project_iam_member to prevent accidentally revoking existing project permissions.
  • Added prefix handling to ensure user:, serviceAccount:, or group: prefixes are correctly formatted.
• Container Image Paths: Updated Cloud Run UI and backend definitions to build registry paths dynamically using var.artifact_registry_repo.

4. Documentation (README.md & terraform/README.md)

• Corrected directory references from backend/ to server/.
• Added instructions to cd server and cd frontend before executing commands.
• Documented NEXT_PUBLIC_API_BASE_URL and NEXT_PUBLIC_APP_BASE_URL configuration.
• Updated gcloud run deploy commands in terraform/README.md to reference correct source directories (server/ and frontend/).

---

Testing & Verification

• Backend: Compiled with OpenJDK 21 (mvn clean compile, mvn package -DskipTests). Verified server boots and serves endpoints (/api/projects, /api/auth/health, /api/datasets, /api/model/list) returning HTTP 200 OK.
• Frontend: Installed dependencies via npm, ran test suite (1,904 tests passing), and verified Next.js production build (next build). Tested local web UI in browser — confirmed React hydration succeeds, tables populate, and API proxy routing works without errors.
• Terraform: Ran terraform init and terraform validate across providers (hashicorp/google and hashicorp/random). Verified dry-run plan (terraform plan) generates resource topology without syntax or reference errors.